[devantler]

🤖 Generated by the Agentic Engineer

Why

Plugin skill updates need to keep working as the internal updater moves to GitHub Marketplace.

What

Adopts the standalone updater while retaining the existing update behavior and review controls, and points the maintenance guidance at its new owner.

Fixes #609

[devantler]

🤖 Generated by the Agentic Engineer

@coderabbitai full review

[coderabbitai]

✅ Action performed

Full review finished.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 32b7241f-d761-492d-b11a-6cf21f563cc2

Commits

Reviewing files that changed from the base of the PR and between 5673211 and b1c402a.

Files selected for processing: 2

• .github/workflows/update-agent-skills.yaml
• AGENTS.md

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

Recent review details

Additional comments: 2

.github/workflows/update-agent-skills.yaml: 1

53-53: LGTM!

AGENTS.md: 1

131-132: LGTM!

Walkthrough

The update job now references devantler-tech/update-agent-skills-action at v1.0.1, pinned to the listed commit. Its inputs and secrets are unchanged. The AGENTS.md links for gh skill update --all and the workflow now point to the standalone action repository.

Possibly related issues

• Publish skill updater on GitHub Marketplace update-agent-skills-action#1 — This issue publishes the standalone action that the workflow now uses.
• Link standalone skill maintenance actions agent-skills#302 — This issue updates skill guidance to reference standalone setup and update actions.
• Publish skill maintenance actions on GitHub Marketplace .github#775 — This issue calls for portfolio callers to move to published actions; this change migrates one caller.

Possibly related PRs

• devantler-tech/agent-plugins#590 — This PR changes the same updater job contract, which this change continues to use.
• devantler-tech/agent-plugins#597 — This PR adds the pins output passed to the updater that this change replaces.
• devantler-tech/agent-plugins#604 — This PR consumes updater outputs in the same workflow, so those output contracts relate to the updater replacement.

Priority: Normal

Merge Risk: Minimal · up to b1c40

The updater migration preserves the existing workflow contract and is ready to merge.

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

Failed checks: 1 inconclusive

Check name	Status	Explanation	Resolution
Linked Issues check		Issue #609 has three checklist items, plus a dependency on devantler-tech/.github#775. 1. Pin to a verified release at its full commit: Met in repository evidence. The head workflow `.github/workflow…	Provide evidence for the following: - The verification result for devantler-tech/.github#775. It must confirm the standalone release v1.0.1 at 0e1d6010a3d8b04a59b64892a5879cd2b45c7432 and its Marketplace listing. - The reusable workflow…

Passed checks: 3 passed

Check name	Status	Explanation
Title check		The title clearly and concisely describes the main change: adopting the standalone Marketplace skill updater.
Description check		The description is directly related to the changes. It explains the need to adopt the standalone updater and update its maintenance ownership.
Out of Scope Changes check		The supplied summary lists two changed files. Both changes match the linked issue #609 and the PR description. - .github/workflows/update-agent-skills.yaml: the update job now points to `devantle…

Full details: Out of Scope Changes check

Explanation

The supplied summary lists two changed files. Both changes match the linked issue #609 and the PR description.

• .github/workflows/update-agent-skills.yaml: the update job now points to devantler-tech/update-agent-skills-action at the pinned commit 0e1d6010a3d8b04a59b64892a5879cd2b45c7432 (+1/-1). Inputs and secrets are unchanged according to the summary. This implements the updater adoption and reference update in #609.
• AGENTS.md: the gh skill update --all link and the update-agent-skills workflow link now point to the new repository (+2/-2). The head file confirms these links. This implements the "update references to the relocated updater" item in #609.

No unrelated changes appear in the summary. The whole-PR diff could not be read, so the file list rests on the supplied summary.

Full details: Linked Issues check

Explanation

Issue #609 has three checklist items, plus a dependency on devantler-tech/.github#775.

1. Pin to a verified release at its full commit: Met in repository evidence. The head workflow .github/workflows/update-agent-skills.yaml calls devantler-tech/update-agent-skills-action/.github/workflows/update-agent-skills.yaml at the 40-character commit 0e1d6010a3d8b04a59b64892a5879cd2b45c7432, annotated # v1.0.1. Release verification is not established from this repository.

2. Preserve skill pins, update scope, signing, credentials, branch identities, and concurrency: Partly established. The caller keeps the scope job, dir, pr-branch, pins, pr-per-skill: true, use-app-token: true, and the APP_PRIVATE_KEY secret. The concurrency group agent-plugins-skill-sync-${{ github.repository }} with queue: max is unchanged in the head file. The signing and credential behavior of the external reusable workflow cannot be read here. The raw summary states that inputs and secrets are unchanged, but the base blob could not be read to confirm this.

3. Update references and verify the native workflow interface before protected merge: References are met. AGENTS.md at head links gh skill update --all and the update-agent-skills workflow to devantler-tech/update-agent-skills-action. The interface check against the external workflow cannot be performed from this repository. The issue also makes adoption wait on the standalone release and Marketplace listing in Publish skill maintenance actions on GitHub Marketplace .github#775, which is not verified here.

The whole-PR diff read was unavailable. The changed-file set and the base content rely on the supplied raw summary.

Resolution

Provide evidence for the following:

• The verification result for Publish skill maintenance actions on GitHub Marketplace .github#775. It must confirm the standalone release v1.0.1 at 0e1d6010a3d8b04a59b64892a5879cd2b45c7432 and its Marketplace listing.
• The reusable workflow interface at devantler-tech/update-agent-skills-action for that commit. It must show the accepted inputs (dir, pr-branch, pins, pr-per-skill, use-app-token) and the APP_PRIVATE_KEY secret. It must also show the signing and credential behavior that the issue requires to be preserved.
• A readable whole-PR diff against merge base 5673211776964d51c60973b2ca1e7e28c68ed656. It must confirm that the previous devantler-tech/.github reference at a2403f8a2640dcf9d342bf7085a906d8e8ec094a was the only functional change in the workflow.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devantler]

🤖 Generated by the Agentic Engineer

Ready at b1c402a. Native CI40596852339 passed. CodeRabbit completed a clean current-head review (summary6455761702); complete thread, pending-review and review-body sweeps are clear, no human direction remains and there is no merge conflict. The body and closing-keyword guards passed. All readable required gates passed; the normal protected merge enforces the opaque code-quality gate.

The only runtime configuration change is the updater's source reference; its inputs, schedule, permissions and follow-up behavior are preserved. I verified the public Marketplace v1.0.1 release attestation resolves to0e1d6010a3d8b04a59b64892a5879cd2b45c7432 and traced its matching caller interface. Native source CI40594567919 exercised the actual updater on Linux/macOS, pins, no-op updates and per-skill mode. The local actionlint1.7.12 concurrency diagnostic reproduces on unchanged main and introduces no new diagnostic.

The first real caller run on main remains post-merge delivery verification. Dispatching this maintenance workflow on a feature branch would repurpose existing updater branches and PR bases, so the live main run is observed after the ordinary protected merge.

[devantler]

🤖 Generated by the Agentic Engineer

Post-merge verification passed at main6ed44e0a5ba652d580523419f13a93563360ec27. The real maintenance run 40601029291, using the declared engineering-practices scope, succeeded. GitHub's run metadata confirms it invoked the standalone updater workflow at verified Marketplace commit0e1d6010a3d8b04a59b64892a5879cd2b45c7432. The actual update job succeeded; there was no drift, so proposal and follow-up jobs correctly stayed idle. No disposable updater branch or PR was created.